DNSSEC, DANE and SMTP Security A Mid-level Overview Wes Hardaker - PowerPoint PPT Presentation

DNSSEC, DANE and SMTP Security A Mid-level Overview Wes Hardaker Parsons Downgrade Resistant, Opportunistic Security for Server To Server E-Mail Delivery

Overview ● Server-to-Server E-Mail background ● SMTP Vulnerabilities ● DANE/SMTP to the rescue ● Implementation and Deployment Status 2 wes.hardaker@parsons.com

Server-to-Server Email Simple Mail Transport Protocol (SMTP) 2: Alice's ISP forwards the Mail Transfer message to Mail Transfer Agent Bob's ISP Agent 1: Alice's 3: Bob's MUA Mail User Agent (MUA) downloads sends the email the message via the configured SMTP via IMAP server 3 wes.hardaker@parsons.com

Server-to-Server Email Server-to-Server Email Simple Mail Simple Mail Transport Protocol Transport Protocol (SMTP) (SMTP) 2: Alice's ISP 2: Alice's ISP forwards the forwards the Mail Transfer Mail Transfer message to message to Mail Transfer Mail Transfer Agent Agent Bob's ISP Bob's ISP Agent Agent 1: Alice's 1: Alice's 3: Bob's MUA 3: Bob's MUA Mail User Agent (MUA) Mail User Agent (MUA) downloads downloads sends the email sends the email the message the message via the configured SMTP via the configured SMTP We're talking about via IMAP via IMAP server server this part today Largely secured today through Manual configuration parameters 4 wes.hardaker@parsons.com

Server-to-Server Email with DNS 1: Where should I send mail for @bobsISP.com? 2: You should send it to mail.bobsISP.com (and the address for it is ….) Mail Transfer DNS Server Agent 3: I've got mail for Bob Mail Transfer Agent 5 wes.hardaker@parsons.com

I Wish It Were So Simple ● There can be multiple DNS servers – Every domain should have at least two ● Alice's mail server asks her ISP's resolver – It doesn't talk directly to the distant DNS server – There may be multiple resolvers ● There can be multiple mail servers 6 wes.hardaker@parsons.com

Server-to-Server Email Reality Sets In 1: Where should I send mail for @bobsISP.com? 2: You should send it to mail1, mail2 or mail3 DNS Server 3: Do you have an address for mail1? DNS Server 4: Yep, it's 192.0.2.3 5: Hi, I'm representing Alice, I have mail for Bob 6: Hi, I'll take mail for Bob; PS: I don't do security 7: Here's the mail for Bob from Alice Mail Transfer 8: Thanks, I'll make sure he gets it Agent Mail Transfer Agent (Actually, reality is even worse but wouldn't fit on this slide) 7 wes.hardaker@parsons.com

Back To: I Wish It Were So Simple ● There can be multiple DNS servers – Every domain should have at least two ● Alice's mail server asks her ISP's resolver – It doesn't talk directly to the distant DNS server – There may be multiple resolvers ● There can be multiple mail servers 8 wes.hardaker@parsons.com

What could possibly go wrong??? ● There can be multiple DNS servers – Compromised? ● Alice's mail server asks her ISP's resolver – It doesn't talk directly to the distant DNS server – Compromised? ● There can be multiple mail servers – Compromised? ● Man In The Middle DNS Attack Network Point!!! 9 wes.hardaker@parsons.com Attack

DANE/DNSSEC To The Rescue ● There can be multiple DNS servers – Compromised? ● Alice's mail server asks her ISP's resolver – It doesn't talk directly to the distant DNS server – Compromised? ● There can be multiple mail servers – Compromised? Use DNSSEC ● Man In The Middle Use 10 wes.hardaker@parsons.com DANE

SMTP Vulnerabilities ● MX, A and other DNS records can be spoofed – DNS redirects SMTP clients to the... – DNSSEC detects this, and clients won't proceed ● Eavesdropping is Easy – SMTP is un encrypted by default – Opportunistic encryption helps ● See if they offer a certificate and start encryption ● However, you may just be encrypting to the... 11 wes.hardaker@parsons.com

SMTP Vulnerabilities ● If DNS is spoofed, you get a... ● ...Man In The Middle – SMTP is unauthenticated by default – SMTP is unencrypted by default – They can turn on opportunistic encryption ● Server indicates “I do security” ● But a man-in-the-middle can just say “I don't do security” – CA based solutions don't help because: ● The man-in-the-middle says “I don't do security” ● You've been redirected to a name the attacker controls 12 wes.hardaker@parsons.com

DNSSEC/DANE For The Win ● DNSSEC and DANE solves all these problems! ● With DNSSEC: you can believe: – The MX that led you here – The TLSA is accurately pointing to my certificate ● With DANE's TLSA record: – “This is my certificate” or “This is my CA” ● (accept no others) – You MUST expect security!!! (i.e., must do TLS) – You connected to the right place 13 wes.hardaker@parsons.com

Deployment Options ● Postfix 2.11 – Server side (receiving mail): ● Publish a TLSA record: _25._tcp.smtp.example.com ● smtpd_tls_cert_file = /path/to/mycert.crt ● smtpd_tls_key_file = /paht/to/mycert.key – Client side (sending mail): ● smtp_tls_security_level = dane ● smtp_dns_support_level = dnssec ● CAVEAT: MUST use a secure local resolver ● Exim: Implementation underway (~ 2015) 14 wes.hardaker@parsons.com

Known Large Early Adopters ● posteo.de ● unitybox.de ● mailbox.org ● debian.org ● bund.de ● ietf.org ● denic.de ● nlnet.nl ● umkbw.de ● nic.cz ● freebsd.org 15 wes.hardaker@parsons.com

Questions? (See me anytime this week if you want a greater level of detail about how it all works) London London 16 June, 2014 June, 2014 wes.hardaker@parsons.com